Hawktalk

Google lost its two recent Court cases for the same reason the one-stop shop does not work

Politicians who are consumed by years in power often decide on a policy that fits their viewpoint, and then identify the “facts” to justify why this policy should be imposed on the rest of us. Mrs Thatcher’s “Poll tax” and the Mr. Blair’s “Iraqi exploits” are classic examples of this genre.

Well I think this kind of approach explains two important data protection issues:

• Why Google, despite its predominate and powerful position, lost two recent Court cases (the ECJ “right to be forgotten” judgment and a UK judgment concerning marketing without consent – see references).

• Why the “one-stop shop”, as proposed by the European Commission in its Regulation, does not work.

I think the European Court of Justice (ECJ) and the UK Court quickly came to the conclusion that Google’s view of the data protection world could not be allowed to dominate the Internet. It then worked back to the legal facts to sustain that view.

So what made a win for Google impossible?

In the ECJ case, Google argued that “Google Inc”, established in USA, were doing the processing of personal data, and that if claimants (or data protection authorities) wanted to have their day in Court, all they need do was pop on a plane take their case, under Californian Law, in the USA Courts. This idea clearly works as a potential revenue stream for the airlines; it’s absolutely hopeless for data subjects.

Just think of the consequences if the ECJ accepted Google’s proposition? It would mean that European citizens (all 0.5 billion plus data subjects) could be required to obtain justice in a jurisdiction that was 4,000 miles away. In addition, if that position were true for Google’s data subjects, it might become true for Facebook’s data subjects, or Yahoo!’s, and all the rest of them.

In other words, I think the Court decided that it could not be expected to agree an outcome that had the unacceptable consequence that condemned European citizens to the risk of privacy violations without meaningful redress in any European Court. This in turn meant a way had to be found to reject Google’s claim.

The same thing happened in the UK when, last year, two appellants claimed that Google was tracking and collating, without their consent or knowledge, personal data relating to the Claimants’ internet usage on the Apple Safari internet browser. They claimed damages or compensation from Google; but on 12 August 2013, Google Inc. applied to the High Court for an order declaring that the English court has no jurisdiction to try these claims because Google Inc. did the processing in the USA.

The Judge rejected this position stating that the claimants were “individuals resident here, for whom bringing proceedings in the USA would be likely to be very burdensome”. In other words, a consequence of the Court accepting the Google Inc claim would be that 60 million UK data subjects might have to take any future case against Google in the USA jurisdiction. This, in effect, means the UK Court faced the same consequence that the ECJ faced, when it considered its judgement.

These judgments explain why the one-stop shop is a problem. Remember, Google, Facebook, Yahoo! etc are not corner shops scratching out an existence in one country; they are mega multinational, established in all European States, making mega-profits from millions of European citizens.

These companies employ smart accountancy techniques so they pay little corporation tax, apart from Ireland which has a low corporation tax and where, by mysterious coincidence, these companies have decided to establish their HQs.

Thus, to have the Irish Data Protection Commissioner (the Commission’s one stop shop solution in the Regulation) looking after the privacy concerns of half a billion European citizens, simply does not work. One can’t expect Greeks, Swedes and Italians to seek redress via the Irish Courts for the same reason why you can’t expect UK citizens to go the USA to take action against Google.

There is still a legal disagreement over the one stop shop as anticipated by the Regulation. I think the two Google judgments should be seen as supporting the view the one stop shop as proposed by the Commission endangers the privacy of all.

References

The UK case: Neutral Citation Number: [2014] EWHC 13 (QB) (Vidal-Hall, Hann and Bradshaw v  Google Inc); http://www.5rb.com/wp-content/uploads/2014/01/Vidal-Hall-v-Google.pdf

The ECJ Judgment: C-131/12 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González” can be found on http://curia.europa.eu/juris/documents.jsf?num=C-131/12

Blog on the one stop shop legal arguments: http://amberhawk.typepad.com/amberhawk/2013/12/ms-reding-heralds-a-disappointing-day-for-data-protection-as-leading-lawyers-have-a-public-cat-fight.html

Why the European Parliament view of “data subject consent” should be supported.

I have been rather ambivalent about the debate about consent in the Directive 95/46/EC and the proposed replacement Regulation (if it happens). However the antics of the Insurance Industry in the UK in relation to subject access have convinced me that the European Parliament’s approach towards consent needs supporting.

So what has the Insurance Industry done to deserve reproach? Well it has continued with its practice of asking, when needed, the data subject to consent to subject access to their own medical records in relation to health insurance products. Although it is not strictly “enforced subject access” (which the Government says is to be a criminal offence in relation to criminal conviction personal data), it is fair to say it is a variant on the same theme.

Legal and General, for instance, explains that its “medical records subject access request” is not enforced Subject Access request because the data subject “consents” to the process; such consent is fully informed and freely given (of course). These sensitive personal data are directly sent to the Insurer and the data subject does not see his own personal data unless he asks the insurer (see references).

Personally, I find the idea that the Insurance Industry can come up with a procedure so that a data subject’s confidential sensitive health details do not pass through the hands of the data subject truly shocking. But let’s not worry about such trifles: the data subject has given consent.

As explained in a previous blog, this consent procedure breaches some Data Protection Principles (e.g. excessive personal data are disclosed on subject access) and the process unfairly by-passes the statutory protection afforded to individuals by the Access to Medical Reports Act. (For a full description see the blog reference).

The problem is that the Insurance Industry approach towards “consent” can be generalised, especially as more and more services are personalised as they move on-line (or made “user-centric” to use the jargon term). For instance, when you apply for a job, you might in future dystopian world be asked to “consent” to a number of things (e.g. to allow others to look at your on-line bank accounts, your Facebook page, the “selfies” on your phone). You even might be asked to consent to issuing a subject access request to your previous employer as references are not what they should be these days.

Of course you can decline to “consent” with the obvious consequences for your employment prospects. In short, I think the arrangements that are increasingly surrounding “data subject consent” exposes the data subject to dubious practices.

Indeed, I can see a future where the practice of what I call “Home Office consent” (after Mr. Blunkett’s infamous ID Card) or “Hobson’s choice” consent could increase. For instance, when you go through airport security to catch your holiday flight you might be asked to go through a scanner. You have a choice: “consent” to be scanned or not go on holiday. The police “invite” you to an interview: they start the interview with the words “thank you for consenting to attend”.

In the UK, for instance, when one takes out a personal loan, you are asked to consent to a number of things, including allowing a credit reference agency to disclose your name and address to third parties for debt tracing purposes.  Such “consent” to disclosure, if one wants a personal loan or mortgage, is a classic example of “Home Office consent”. No consent, no loan.

Now I am not saying there should be no tracing of data subjects. Clearly there is a public interest in ensuring that data subjects are not overloaded with debt or honour their debts, especially in these economically stressed times. However, one wonders whether degrading the concept of “consent” is the best way to deliver this public interest objective.

Far better in my view is for such disclosures to be “necessary” for a contract with the data subject or perhaps “necessary” in the legitimate interests of a third party to whom the personal data are disclosed.

The reason for this? It ensures that the data controller, or credit reference agency in this case, has to consider a test of “necessity” before making any disclosure. With the current arrangements which depend of “data subject consent”, the disclosing party does not need to assess anything – disclosure can go ahead willy-nilly on a “consensual” basis.

The European Parliament achieves the inclusion of a much needed “necessity” test very simply. It states in its amended Article 7 that “The execution of a contract or the provision of a service shall not be made conditional on the consent to the processing of data that is not necessary for the execution of the contract.

In current Data Protection Act Schedule 2 terms, the consent ground would become invalid and any other ground that legitimises the disclosure of personal data will need another ground which is qualified by the words: “the processing is necessary …..”

The European Parliament amendment will also extend to any sensitive personal data obtained by “consensual” subject access routes.

That is why this amendment should be supported; perhaps even by UKIP!

References

Legal and General approach to Subject Access; follow the three forms on: http://www.legalandgeneral.com/advisercentre/protection/underwriting/tools/disclosure-evidence/

Previous blog on this variant of enforced subject access: http://amberhawk.typepad.com/amberhawk/2012/02/enforced-subject-access-raises-its-ugly-head-in-the-context-of-medical-insurance.html

Useful comparison between the European Parliament’s amendments and the original Regulation text: http://www.europarl.europa.eu/sides/getDoc.do?type=TA&reference=P7-TA-2014-0212&language=EN

If Google remembers whom it has forgotten, has it complied with the ECJ Judgment?

Google has received all kinds of plaudits for quickly introducing its “right to be forgotten” procedure; however from what I have read in the press, its procedure for the removal of URLs is not fit for purpose. In this blog, I explain why Google’s procedure appears to be so defective.

So, for the sake of argument, let’s assume that you want to have a URL removed for whatever reason. As I explained in my previous blogs (see references), this will engage a balance between freedom of expression and privacy; it is not an automatic removal of links as is still commonly asserted.

Google’s “right to be forgotten” form (see references for link) is fairly straight-forward. It asks for your photo identity (to make sure the data subject is completing the form), contact email address (e.g. to tell you of the outcome of your request), the country where you live (to identify which country’s Data Protection Act applies), the URL(s) that you object to and an explanation why you find each “URL in search results is irrelevant, outdated, or otherwise inappropriate”.

As an aside, an inference from the above is the possibility that Google might not be offering its URL removal procedure to USA citizens who apply for URL links to be removed by European Google companies. As readers know the definition of "data subject" depends on whether the applicant is alive and not nationality (i.e. European data protection law is not limited to European data subjects). Google should be asked, for example, the extent to which the procedure is open to USA citizens.

Google says on the form that before making a decision, it will balance your interests in having an URL removed (i.e. your privacy) versus the right of the public to know the information (i.e. keep a URL).

As a data controller, Google will come to a decision about the URL you want removed. If that decision goes against you, you will have to ask the Information Commissioner for an assessment under Section 42 of the Data Protection Act. However, if Google UK accepts your request, your URL will be removed from all Google companies in any EEA state. However, this means that the URL will be accessible from Google.com which is based in the USA.

I have been unable to find any indication of whether or not Google intends to retain a record of any removed URL against the data subject’s name (e.g. stored in the USA at Google.com); someone should seek clarification from Google as to the position here.

However, Google’s form goes further; it says that “we may inform webmaster(s) whose content is removed from our search results as a result of your complaint”. In other words, Google’s implementation of your right to be forgotten includes the functionality of Google remembering that that you exercised the right to be forgotten.

Indeed a Google spokesperson told “Search Engine Land” (see references) that:

“To be very clear about this: if someone asks for a URL to be removed from the listings for their name, and that’s approved, the URL will go away — but anyone who looks at the bottom of the result will know that they must have asked for something to be removed.”

“It’s also likely that Google will provide a link to ChillingEffects.org, as it does with many other types of censorship requests, where people can learn more about what is removed. Names wouldn’t be revealed, though those can be deducted from the search. The URLs taken-down probably wouldn’t be revealed. But it’s possible there would be some general explanation about what was removed or maybe why something was removed.”

To get an idea of what this means, please open another tab and Google “Frozen movie”. In the UK, you will see Google provides a comment on several pages (from page 2) that “In response to a complaint we received under the US Digital Millennium Copyright Act (DMCA), we have removed 1 result(s) from this page. If you wish, you may read the DMCA complaint that caused the removal(s) at ChillingEffects.org”.

In other words, if someone searched for an individual in the UK, Google’s search results under its procedure to comply with the ECJ ruling could include a statement that is something like: “In response to a complaint, we have removed some links”. This is a message to the searcher to go to Google.com site in the USA, and repeat the search on the data subject to obtain the links that have removed from Google’s European companies.

Clearly, therefore, a data subject who wants to be forgotten is not even half-forgotten. Indeed, if there exists a flag that says the data subject wanted to be forgotten then this might be more damaging (e.g. to the data subject’s employment prospects) than a URL that the data subject wants removed. After all, some employers will argue there is no smoke without fire and won’t take an employment risk.

This may be the case even if the data subject who requested the URL removal shares his name with other individuals. In this way, individuals with the same name as the data subject who used Google's procedure could be impacted.

So back to a question that should be asked of Google; namely: “is the above kind of avoidance procedure Google’s deliberate intent?”.

If the procedure is intentional, Google has not complied with the spirit of the judgment (the message radiating from all the press plaudits); instead it has given the proverbial two fingers to Europe’s highest Court and arranged procedures to evade its judgment. So much for the rule of law, eh?

Google has been in the forefront of complaints about the NSA in light of the Snowden revelations and the need for a communications data retention law in the USA that applies to the rest of the world. It would undermine its stance completely if Google were now to argue that one law for retention of URLs applies in Europe and another in the rest of the world.

References:

Google’s right to object form: https://support.google.com/legal/contact/lr_eudpa?product=websearch

Detailed write up of Google’s procedure:  http://searchengineland.com/google-right-to-be-forgotten-form-192837

Previous blogs on the Google judgment

(1) Press and Google misrepresent European Court’s Google judgement http://amberhawk.typepad.com/amberhawk/2014/05/press-and-google-misrepresent-european-courts-google-judgement.html

(2) If the European Court has established a right to be forgotten, it has also established a right to object to marketing: http://amberhawk.typepad.com/amberhawk/2014/05/if-the-european-court-has-established-a-right-to-be-forgotten-it-has-also-established-a-right-to-object-to-marketing.html